Apparatus, embedded software application, data carrier, computer program, and method for fuzz testing embedded software applications

Abstract

An apparatus, an embedded software application, a data carrier, a computer program, and a method for fuzz testing embedded software applications is disclosed. The method comprises identifying, from a plurality of keywords, network user input keywords related to network user inputs. Also, the method comprises providing the identified keywords as seed for fuzz testing an embedded software application and testing the software based on the seed.

1 . A method for fuzz testing an embedded software application, the method comprising:
 identifying, from a plurality of keywords, network user input keywords related to network user inputs;   providing the identified keywords as seed for fuzz testing the embedded software application; and   testing the embedded software application based on the seed.   
     
     
         2 . The method of  claim 1 , wherein identifying network user input keywords comprises excluding keywords which are not related to network user input. 
     
     
         3 . The method of  claim 1 , wherein identifying the network user input keywords comprises determining whether a keyword is not to be used in a critical comparison function of the software. 
     
     
         4 . The method of  claim 3 , wherein determining if a keyword is not to be used in a critical comparison function comprises determining whether no control dependency exists between an address of the critical comparison function and an address of the keyword. 
     
     
         5 . The method of  claim 4 , wherein determining whether no control dependency exists comprises:
 obtaining a function call chain to the address of the keyword, wherein the function call chain includes one or more sub-functions;   identifying parent functions of the sub-functions; and   checking whether no control dependencies between the parent functions and the critical comparison function.   
     
     
         6 . The method of  claim 1 , wherein testing the embedded software application based on the seed comprises applying a mutation to the seed, wherein the seed related to the network user input keywords is prioritized over other seeds not related to the network user input keywords. 
     
     
         7 . The method of  claim 1 , wherein testing the embedded software application comprises testing one or more injection points for injection attacks based on the seed related to the network user input keywords. 
     
     
         8 . The method  claim 1 , wherein the method further comprises:
 providing a test result based on testing the embedded software application based on the seed; and   adapting the embedded software application based on the test result to reduce vulnerabilities.   
     
     
         9 . A computer program comprising instructions which, when the computer program is executed by a computer, cause the computer to carry out a method for fuzz testing an embedded software application, the method comprising:
 identifying, from a plurality of keywords, network user input keywords related to network user inputs;   providing the identified keywords as seed for fuzz testing the embedded software application; and   testing the embedded software application based on the seed.   
     
     
         10 . A computer-readable data carrier having stored thereon the computer program comprising instructions which, when the computer program is executed by a computer, cause the computer to carry out a method for fuzz testing an embedded software application, the method comprising:
 identifying, from a plurality of keywords, network user input keywords related to network user inputs;   providing the identified keywords as seed for fuzz testing the embedded software application; and   testing the embedded software application based on the seed.   
     
     
         11 . An embedded software application obtainable by a method, the method comprising:
 identifying, from a plurality of keywords, network user input keywords related to network user inputs;   providing the identified keywords as seed for fuzz testing the embedded software application; and   testing the embedded software application based on the seed.   
     
     
         12 . An apparatus, the apparatus comprising:
 one or more interfaces for communication; and   a data processing circuit configured to execute a method, the method comprising:
 identifying, from a plurality of keywords, network user input keywords related to network user inputs; 
 providing the identified keywords as seed for fuzz testing an embedded software application; and 
 testing the embedded software application based on the seed.